Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

Pull security layer updates from James Morris:
 "There are a bunch of fixes to the TPM, IMA, and Keys code, with minor
  fixes scattered across the subsystem.

  IMA now requires signed policy, and that policy is also now measured
  and appraised"

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (67 commits)
  X.509: Make algo identifiers text instead of enum
  akcipher: Move the RSA DER encoding check to the crypto layer
  crypto: Add hash param to pkcs1pad
  sign-file: fix build with CMS support disabled
  MAINTAINERS: update tpmdd urls
  MODSIGN: linux/string.h should be #included to get memcpy()
  certs: Fix misaligned data in extra certificate list
  X.509: Handle midnight alternative notation in GeneralizedTime
  X.509: Support leap seconds
  Handle ISO 8601 leap seconds and encodings of midnight in mktime64()
  X.509: Fix leap year handling again
  PKCS#7: fix unitialized boolean 'want'
  firmware: change kernel read fail to dev_dbg()
  KEYS: Use the symbol value for list size, updated by scripts/insert-sys-cert
  KEYS: Reserve an extra certificate symbol for inserting without recompiling
  modsign: hide openssl output in silent builds
  tpm_tis: fix build warning with tpm_tis_resume
  ima: require signed IMA policy
  ima: measure and appraise the IMA policy itself
  ima: load policy using path
  ...

5 files changed, 51 insertions, 26 deletions

diff --git a/include/linux/fs.h b/include/linux/fs.h
index ae681002100a..e514f76db04f 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2576,7 +2576,22 @@ static inline void i_readcount_inc(struct inode *inode)
 #endif
 extern int do_pipe_flags(int *, int);
 
+enum kernel_read_file_id {
+        READING_FIRMWARE = 1,
+        READING_MODULE,
+        READING_KEXEC_IMAGE,
+        READING_KEXEC_INITRAMFS,
+        READING_POLICY,
+        READING_MAX_ID
+};
+
 extern int kernel_read(struct file *, loff_t, char *, unsigned long);
+extern int kernel_read_file(struct file *, void **, loff_t *, loff_t,
+                            enum kernel_read_file_id);
+extern int kernel_read_file_from_path(char *, void **, loff_t *, loff_t,
+                                      enum kernel_read_file_id);
+extern int kernel_read_file_from_fd(int, void **, loff_t *, loff_t,
+                                    enum kernel_read_file_id);
 extern ssize_t kernel_write(struct file *, const char *, size_t, loff_t);
 extern ssize_t __kernel_write(struct file *, const char *, size_t, loff_t *);
 extern struct file * open_exec(const char *);
diff --git a/include/linux/ima.h b/include/linux/ima.h
index 120ccc53fcb7..e6516cbbe9bf 100644
--- a/include/linux/ima.h
+++ b/include/linux/ima.h
@@ -18,8 +18,9 @@ extern int ima_bprm_check(struct linux_binprm *bprm);
 extern int ima_file_check(struct file *file, int mask, int opened);
 extern void ima_file_free(struct file *file);
 extern int ima_file_mmap(struct file *file, unsigned long prot);
-extern int ima_module_check(struct file *file);
-extern int ima_fw_from_file(struct file *file, char *buf, size_t size);
+extern int ima_read_file(struct file *file, enum kernel_read_file_id id);
+extern int ima_post_read_file(struct file *file, void *buf, loff_t size,
+                              enum kernel_read_file_id id);
 
 #else
 static inline int ima_bprm_check(struct linux_binprm *bprm)
@@ -42,12 +43,13 @@ static inline int ima_file_mmap(struct file *file, unsigned long prot)
         return 0;
 }
 
-static inline int ima_module_check(struct file *file)
+static inline int ima_read_file(struct file *file, enum kernel_read_file_id id)
 {
         return 0;
 }
 
-static inline int ima_fw_from_file(struct file *file, char *buf, size_t size)
+static inline int ima_post_read_file(struct file *file, void *buf, loff_t size,
+                                     enum kernel_read_file_id id)
 {
         return 0;
 }
diff --git a/include/linux/key.h b/include/linux/key.h
index 7321ab8ef949..5f5b1129dc92 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -219,6 +219,7 @@ extern struct key *key_alloc(struct key_type *type,
 #define KEY_ALLOC_QUOTA_OVERRUN 0x0001  /* add to quota, permit even if overrun */
 #define KEY_ALLOC_NOT_IN_QUOTA  0x0002  /* not in quota */
 #define KEY_ALLOC_TRUSTED       0x0004  /* Key should be flagged as trusted */
+#define KEY_ALLOC_BUILT_IN      0x0008  /* Key is built into kernel */
 
 extern void key_revoke(struct key *key);
 extern void key_invalidate(struct key *key);
diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
index 71969de4058c..cdee11cbcdf1 100644
--- a/include/linux/lsm_hooks.h
+++ b/include/linux/lsm_hooks.h
@@ -541,25 +541,24 @@
  *      @inode points to the inode to use as a reference.
  *      The current task must be the one that nominated @inode.
  *      Return 0 if successful.
- * @kernel_fw_from_file:
- *      Load firmware from userspace (not called for built-in firmware).
- *      @file contains the file structure pointing to the file containing
- *      the firmware to load. This argument will be NULL if the firmware
- *      was loaded via the uevent-triggered blob-based interface exposed
- *      by CONFIG_FW_LOADER_USER_HELPER.
- *      @buf pointer to buffer containing firmware contents.
- *      @size length of the firmware contents.
- *      Return 0 if permission is granted.
  * @kernel_module_request:
  *      Ability to trigger the kernel to automatically upcall to userspace for
  *      userspace to load a kernel module with the given name.
  *      @kmod_name name of the module requested by the kernel
  *      Return 0 if successful.
- * @kernel_module_from_file:
- *      Load a kernel module from userspace.
- *      @file contains the file structure pointing to the file containing
- *      the kernel module to load. If the module is being loaded from a blob,
- *      this argument will be NULL.
+ * @kernel_read_file:
+ *      Read a file specified by userspace.
+ *      @file contains the file structure pointing to the file being read
+ *      by the kernel.
+ *      @id kernel read file identifier
+ *      Return 0 if permission is granted.
+ * @kernel_post_read_file:
+ *      Read a file specified by userspace.
+ *      @file contains the file structure pointing to the file being read
+ *      by the kernel.
+ *      @buf pointer to buffer containing the file contents.
+ *      @size length of the file contents.
+ *      @id kernel read file identifier
  *      Return 0 if permission is granted.
  * @task_fix_setuid:
  *      Update the module's state after setting one or more of the user
@@ -1454,9 +1453,11 @@ union security_list_options {
         void (*cred_transfer)(struct cred *new, const struct cred *old);
         int (*kernel_act_as)(struct cred *new, u32 secid);
         int (*kernel_create_files_as)(struct cred *new, struct inode *inode);
-        int (*kernel_fw_from_file)(struct file *file, char *buf, size_t size);
         int (*kernel_module_request)(char *kmod_name);
         int (*kernel_module_from_file)(struct file *file);
+        int (*kernel_read_file)(struct file *file, enum kernel_read_file_id id);
+        int (*kernel_post_read_file)(struct file *file, char *buf, loff_t size,
+                                     enum kernel_read_file_id id);
         int (*task_fix_setuid)(struct cred *new, const struct cred *old,
                                 int flags);
         int (*task_setpgid)(struct task_struct *p, pid_t pgid);
@@ -1715,9 +1716,9 @@ struct security_hook_heads {
         struct list_head cred_transfer;
         struct list_head kernel_act_as;
         struct list_head kernel_create_files_as;
-        struct list_head kernel_fw_from_file;
+        struct list_head kernel_read_file;
+        struct list_head kernel_post_read_file;
         struct list_head kernel_module_request;
-        struct list_head kernel_module_from_file;
         struct list_head task_fix_setuid;
         struct list_head task_setpgid;
         struct list_head task_getpgid;
diff --git a/include/linux/security.h b/include/linux/security.h
index 4824a4ccaf1c..157f0cb1e4d2 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -24,10 +24,12 @@
 
 #include <linux/key.h>
 #include <linux/capability.h>
+#include <linux/fs.h>
 #include <linux/slab.h>
 #include <linux/err.h>
 #include <linux/string.h>
 #include <linux/mm.h>
+#include <linux/fs.h>
 
 struct linux_binprm;
 struct cred;
@@ -298,9 +300,11 @@ int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp);
 void security_transfer_creds(struct cred *new, const struct cred *old);
 int security_kernel_act_as(struct cred *new, u32 secid);
 int security_kernel_create_files_as(struct cred *new, struct inode *inode);
-int security_kernel_fw_from_file(struct file *file, char *buf, size_t size);
 int security_kernel_module_request(char *kmod_name);
 int security_kernel_module_from_file(struct file *file);
+int security_kernel_read_file(struct file *file, enum kernel_read_file_id id);
+int security_kernel_post_read_file(struct file *file, char *buf, loff_t size,
+                                   enum kernel_read_file_id id);
 int security_task_fix_setuid(struct cred *new, const struct cred *old,
                              int flags);
 int security_task_setpgid(struct task_struct *p, pid_t pgid);
@@ -850,18 +854,20 @@ static inline int security_kernel_create_files_as(struct cred *cred,
         return 0;
 }
 
-static inline int security_kernel_fw_from_file(struct file *file,
-                                               char *buf, size_t size)
+static inline int security_kernel_module_request(char *kmod_name)
 {
         return 0;
 }
 
-static inline int security_kernel_module_request(char *kmod_name)
+static inline int security_kernel_read_file(struct file *file,
+                                            enum kernel_read_file_id id)
 {
         return 0;
 }
 
-static inline int security_kernel_module_from_file(struct file *file)
+static inline int security_kernel_post_read_file(struct file *file,
+                                                 char *buf, loff_t size,
+                                                 enum kernel_read_file_id id)
 {
         return 0;
 }